The present invention relates to a safety circuit, especially for transportation systems, such as elevators, comprising at least one switching circuit composed of two digital logical elements, each of which are arranged in a separate information channel and connected at the input side with information transmitters generating anti-valent signals and at the output side with a monitoring circuit in the form of an equivalent (INCLUSIVE-OR)- or anti-valent (EXCLUSIVE-OR) circuit for monitoring the anti-valence of the output signals.
The purpose of such type safety circuits, while taking into account the prevailing regulations, is to check whether there are present the prerequisites for placing into operation without danger the relevant system or installation which is to be protected and upon discovering errors which could lead to a dangerous operating condition preventing placement of the installation into operation.
In the construction of elevators or lifts for instance there exists the requirement that if an error together with a second error can lead to a dangerous operating condition, then at the latest during the next following condition changer during the course of the operation when the faulty functional element should come into play, the system or installation should be brought to standstill and there must be prevented an automatic restarting.
In this connection there is not taken into account that the second error also comes into play in leading to the dangerous operating condition before there is brought about standstill of the installation by the condition change.
In German patent publication No. 1,537,379 there is taught a safety circuit possessing logical components having two separate channels for the equivalent and their anti-valent switching variables. The one channel contains a NAND-element and the other a NOR-element as the logical elements. Further, at the input there are available anti-valent switching variables in the form of squarewave voltages with a predetermined repetition frequency and at the outputs of both logic elements there is connected a monitoring element which can be interrogated by test signals. As the monitoring element there is used an electronic switching amplifier, the supply voltage of which is tapped-off from the outputs of both logic elements. According to a further construction of the safety circuit the monitoring elements associated with the logic components form a series circuit wherein in each case the output of a monitoring element is connected with the input of the following monitoring element, and further, at the first monitoring element of the series circuit there is connected a test signal source and at the last monitoring element a group of components monitoring its output signals and comparing such with the test signals.
The drawback of this safety circuit resides especially in the fact that upon the occurrence of two errors in the logic components, for instance a respective error in both logic elements or a faulty logic element and a signal state of the inputs of the logic elements leading to equivalence of the output signals there can likewise be present anti-valence or anti-equivalence of the output signals. If both of the errors occur in timely succession, then, they can be detected by the test signals which follow one another as a function of time and emanating from the test signal source. However, if the errors occur simultaneously then it is not possible to detect the same by means of the monitoring element.
In German patent publication No. 1,055,782 there is taught a safety device for electrically operated elevators wherein there is used as the feeler or scanning device of a region which is to be protected, for instance within the door opening of an elevator cabin, one or a number of light barriers composed of light sources and photoelectric cells with appropriate relays. This apparatus is particularly characterized by the features that the control current circuit which switches-on the elevator drive is connected via a control device arranged in series with the motor protection switch, the control device comprising a series circuit consisting of the contact of a checking relay and the contacts of the photocell relay. The control device serves to control the feeler or scanning device in such a manner that it briefly shuts-off the light sources and only establishes the electrical connection to the motor protection switch when, upon shutting-off the light sources, the relays associated with the photocells are deenergized.
With this safety device for elevators there is thus checked the correct functioning of the switching element after releasing a travel command, before such is executed, by simulating an error preventing travel.
However, this safety device is associated with the drawback that upon defect of the testing or checking relay or the sticking of one of its contacts the feeler or scanning device no longer can be checked with respect to its functional reliability, so that the drawbacks associated with the light barriers, such as aging of the tubes, disturbances in the amplifiers, sticking of the relays and so forth, have an effect upon the operational reliability of the system. The simultaneous occurrence of two errors therefore leads to a dangerous operating condition which goes unnoticed by the safety circuit.